# Vulnerabilities published in 2023


- [CVE-2023-1180](https://insights.sbomify.com/CVE-2023-1180/): SourceCodester Health Center Patient Record Management System hematology_print.php cross site scripting (low 3.5)
- [CVE-2023-1179](https://insights.sbomify.com/CVE-2023-1179/): SourceCodester Computer Parts Sales and Inventory System Add Supplier cross site scripting (low 3.5)
- [CVE-2023-1178](https://insights.sbomify.com/CVE-2023-1178/): Code injection in GitLab (medium 5.7)
- [CVE-2023-1177](https://insights.sbomify.com/CVE-2023-1177/): Path Traversal: '\..\filename' in mlflow/mlflow (critical 9.3)
- [CVE-2023-1176](https://insights.sbomify.com/CVE-2023-1176/): Absolute Path Traversal in mlflow/mlflow (medium 5.3)
- [CVE-2023-1175](https://insights.sbomify.com/CVE-2023-1175/): Incorrect Calculation of Buffer Size in vim/vim (high 7.3)
- [CVE-2023-1174](https://insights.sbomify.com/CVE-2023-1174/): [minikube] Network Port exposure in minikube running on macOS using Docker driver (critical 9.8)
- [CVE-2023-1172](https://insights.sbomify.com/CVE-2023-1172/): Cross-site scripting in WordPress Online Booking and Scheduling Plugin – Bookly (high 7.2)
- [CVE-2023-1170](https://insights.sbomify.com/CVE-2023-1170/): Heap-based Buffer Overflow in vim/vim (high 7.3)
- [CVE-2023-1169](https://insights.sbomify.com/CVE-2023-1169/): OoohBoi Steroids for Elementor <= 2.1.4 - Missing Authorization leading to Authenticated (Subscriber+) Image Upload (medium 4.3)
- [CVE-2023-1168](https://insights.sbomify.com/CVE-2023-1168/): Authenticated Remote Code Execution in Aruba CX Switches (high 7.2)
- [CVE-2023-1167](https://insights.sbomify.com/CVE-2023-1167/): Missing authorization in GitLab (medium 5.3)
- [CVE-2023-1166](https://insights.sbomify.com/CVE-2023-1166/): USM Premium < 16.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-1165](https://insights.sbomify.com/CVE-2023-1165/): Zhong Bang CRMEB Java list sql injection (medium 5.5)
- [CVE-2023-1164](https://insights.sbomify.com/CVE-2023-1164/): KylinSoft kylin-activation File Import improper authorization (high 8.4)
- [CVE-2023-1163](https://insights.sbomify.com/CVE-2023-1163/): DrayTek Vigor 2960 Web Management Interface mainfunction.cgi getSyslogFile path traversal (medium 6.5)
- [CVE-2023-1162](https://insights.sbomify.com/CVE-2023-1162/): DrayTek Vigor 2960 Web Management Interface mainfunction.cgi command injection (high 7.2)
- [CVE-2023-1161](https://insights.sbomify.com/CVE-2023-1161/): Memory corruption in Wireshark (medium 6.3)
- [CVE-2023-1160](https://insights.sbomify.com/CVE-2023-1160/): Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit (medium 4.0)
- [CVE-2023-1159](https://insights.sbomify.com/CVE-2023-1159/): Cross-site scripting in WordPress Online Booking and Scheduling Plugin – Bookly (medium 4.0)
- [CVE-2023-1158](https://insights.sbomify.com/CVE-2023-1158/): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (medium 4.3)
- [CVE-2023-1157](https://insights.sbomify.com/CVE-2023-1157/): finixbit elf-parser elf_parser.cpp get_segments denial of service (low 2.8)
- [CVE-2023-1156](https://insights.sbomify.com/CVE-2023-1156/): SourceCodester Health Center Patient Record Management System fecalysis_form.php cross site scripting (low 3.5)
- [CVE-2023-1155](https://insights.sbomify.com/CVE-2023-1155/): Cost Calculator <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2023-1154](https://insights.sbomify.com/CVE-2023-1154/): XSS in Pacsrapor (medium 6.1)
- [CVE-2023-1153](https://insights.sbomify.com/CVE-2023-1153/): SQLi in Pacsrapor (critical 9.8)
- [CVE-2023-1152](https://insights.sbomify.com/CVE-2023-1152/): SQLi in Utarit Persolus (critical 9.8)
- [CVE-2023-1151](https://insights.sbomify.com/CVE-2023-1151/): SourceCodester Electronic Medical Records System Cookie administrator.php sql injection (medium 6.3)
- [CVE-2023-1150](https://insights.sbomify.com/CVE-2023-1150/): WAGO: Series 750-3x/-8x prone to MODBUS server DoS (high 7.5)
- [CVE-2023-1149](https://insights.sbomify.com/CVE-2023-1149/): Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver (medium 5.7)
- [CVE-2023-1148](https://insights.sbomify.com/CVE-2023-1148/): Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress (medium 6.5)
- [CVE-2023-1147](https://insights.sbomify.com/CVE-2023-1147/): Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress (medium 6.5)
- [CVE-2023-1146](https://insights.sbomify.com/CVE-2023-1146/): Cross-site Scripting (XSS) - Generic in flatpressblog/flatpress (medium 5.4)
- [CVE-2023-1145](https://insights.sbomify.com/CVE-2023-1145/): Deserialization in InfraSuite Device Master (high 7.8)
- [CVE-2023-1144](https://insights.sbomify.com/CVE-2023-1144/): CVE-2023-1144 (high 8.8)
- [CVE-2023-1143](https://insights.sbomify.com/CVE-2023-1143/): CVE-2023-1143 (high 8.8)
- [CVE-2023-1142](https://insights.sbomify.com/CVE-2023-1142/): CVE-2023-1142 (high 7.5)
- [CVE-2023-1141](https://insights.sbomify.com/CVE-2023-1141/): CVE-2023-1141 (high 8.8)
- [CVE-2023-1140](https://insights.sbomify.com/CVE-2023-1140/): CVE-2023-1140 (critical 9.8)
- [CVE-2023-1139](https://insights.sbomify.com/CVE-2023-1139/): CVE-2023-1139 (high 8.8)
- [CVE-2023-1138](https://insights.sbomify.com/CVE-2023-1138/): CVE-2023-1138 (high 7.5)
- [CVE-2023-1137](https://insights.sbomify.com/CVE-2023-1137/): CVE-2023-1137 (medium 6.5)
- [CVE-2023-1136](https://insights.sbomify.com/CVE-2023-1136/): CVE-2023-1136 (critical 9.8)
- [CVE-2023-1135](https://insights.sbomify.com/CVE-2023-1135/): Misconfiguration in InfraSuite Device Master (high 7.8)
- [CVE-2023-1134](https://insights.sbomify.com/CVE-2023-1134/): CVE-2023-1134 (high 7.1)
- [CVE-2023-1133](https://insights.sbomify.com/CVE-2023-1133/): CVE-2023-1133 (critical 9.8)
- [CVE-2023-1132](https://insights.sbomify.com/CVE-2023-1132/): Key duplication in GSDK (medium 5.3)
- [CVE-2023-1131](https://insights.sbomify.com/CVE-2023-1131/): SourceCodester Computer Parts Sales and Inventory System customer.php cross site scripting (low 3.5)
- [CVE-2023-1130](https://insights.sbomify.com/CVE-2023-1130/): SourceCodester Computer Parts Sales and Inventory System processlogin sql injection (medium 6.3)
- [CVE-2023-1129](https://insights.sbomify.com/CVE-2023-1129/): WP FEvents Book <= 0.46 - Subscriber+ Arbitrary Booking Manipulation via IDOR (medium 6.5)
- [CVE-2023-1127](https://insights.sbomify.com/CVE-2023-1127/): Divide By Zero in vim/vim (high 7.3)
- [CVE-2023-1126](https://insights.sbomify.com/CVE-2023-1126/): WP FEvents Book <= 0.46 - Subscriber+ Stored XSS (medium 5.4)
- [CVE-2023-1125](https://insights.sbomify.com/CVE-2023-1125/): Ruby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDOR (medium 6.5)
- [CVE-2023-1124](https://insights.sbomify.com/CVE-2023-1124/): Shopping Cart & eCommerce Store < 5.4.3 - Admin+ LFI (high 7.2)
- [CVE-2023-1122](https://insights.sbomify.com/CVE-2023-1122/): Simple Giveaways < 2.45.1 - Editor+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2023-1121](https://insights.sbomify.com/CVE-2023-1121/): Simple Giveaways < 2.45.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2023-1120](https://insights.sbomify.com/CVE-2023-1120/): Simple Giveaways < 2.45.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-1119](https://insights.sbomify.com/CVE-2023-1119/): Multiple Plugins - Cross-Site Scripting From Third-party Library (medium 6.1)
- [CVE-2023-1118](https://insights.sbomify.com/CVE-2023-1118/): Use after free in Kernel (high 7.8)
- [CVE-2023-1117](https://insights.sbomify.com/CVE-2023-1117/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 4.8)
- [CVE-2023-1116](https://insights.sbomify.com/CVE-2023-1116/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 5.4)
- [CVE-2023-1115](https://insights.sbomify.com/CVE-2023-1115/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (high 7.6)
- [CVE-2023-1114](https://insights.sbomify.com/CVE-2023-1114/): Improper Input Validation on e-Belediye (critical 9.8)
- [CVE-2023-1113](https://insights.sbomify.com/CVE-2023-1113/): SourceCodester Simple Payroll System POST Parameter cross site scripting (low 2.4)
- [CVE-2023-1112](https://insights.sbomify.com/CVE-2023-1112/): Drag and Drop Multiple File Upload Contact Form 7 admin-ajax.php path traversal (medium 4.7)
- [CVE-2023-1111](https://insights.sbomify.com/CVE-2023-1111/): FastCMS New Article Tab cross site scripting (medium 5.1)
- [CVE-2023-1110](https://insights.sbomify.com/CVE-2023-1110/): Yellow Yard < 2.8.12 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-1109](https://insights.sbomify.com/CVE-2023-1109/): PHOENIX CONTACT: Directory Traversal Vulnerability in ENERGY AXC PU Web service (high 8.8)
- [CVE-2023-1108](https://insights.sbomify.com/CVE-2023-1108/): Undertow: infinite loop in sslconduit during close (high 7.5)
- [CVE-2023-1107](https://insights.sbomify.com/CVE-2023-1107/): Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress (medium 6.5)
- [CVE-2023-1106](https://insights.sbomify.com/CVE-2023-1106/): Cross-site Scripting (XSS) - Reflected in flatpressblog/flatpress (medium 5.3)
- [CVE-2023-1105](https://insights.sbomify.com/CVE-2023-1105/): External Control of File Name or Path in flatpressblog/flatpress (high 7.5)
- [CVE-2023-1104](https://insights.sbomify.com/CVE-2023-1104/): Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress (high 8.1)
- [CVE-2023-1101](https://insights.sbomify.com/CVE-2023-1101/): Security feature bypass in SonicOS (high 8.8)
- [CVE-2023-1100](https://insights.sbomify.com/CVE-2023-1100/): SourceCodester Online Catering Reservation System POST Parameter add_message.php sql injection (medium 6.3)
- [CVE-2023-1099](https://insights.sbomify.com/CVE-2023-1099/): SourceCodester Online Student Management System edit-class-detail.php sql injection (medium 6.3)
- [CVE-2023-1098](https://insights.sbomify.com/CVE-2023-1098/): Information disclosure in GitLab (medium 5.8)
- [CVE-2023-1097](https://insights.sbomify.com/CVE-2023-1097/): Unauthenticated Command Injection EG7035-M11 Series (critical 9.3)
- [CVE-2023-1096](https://insights.sbomify.com/CVE-2023-1096/): Auth bypass in SnapCenter (critical 9.8)
- [CVE-2023-1095](https://insights.sbomify.com/CVE-2023-1095/): Null dereference in Linux kernel netfilter subsystem. (medium 5.5)
- [CVE-2023-1094](https://insights.sbomify.com/CVE-2023-1094/): Cross-site scripting in MonicaHQ (high 8.0)
- [CVE-2023-1093](https://insights.sbomify.com/CVE-2023-1093/): OAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRF (medium 6.5)
- [CVE-2023-1092](https://insights.sbomify.com/CVE-2023-1092/): OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF (medium 6.5)
- [CVE-2023-1091](https://insights.sbomify.com/CVE-2023-1091/): SQL Injection found in ALPATA's Licensed Warehousing Automation System (critical 9.8)
- [CVE-2023-1090](https://insights.sbomify.com/CVE-2023-1090/): WP SMTP Mailing Queue < 2.0.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-1089](https://insights.sbomify.com/CVE-2023-1089/): Coupon Zen < 1.0.6 - Arbitrary Plugin Activation via CSRF (medium 4.3)
- [CVE-2023-1088](https://insights.sbomify.com/CVE-2023-1088/): WP Plugin Manager < 1.1.8 - Arbitrary Plugin Activation via CSRF (medium 4.3)
- [CVE-2023-1087](https://insights.sbomify.com/CVE-2023-1087/): WC Sales Notification < 1.2.3 - Arbitrary Plugin Activation via CSRF (medium 4.3)
- [CVE-2023-1086](https://insights.sbomify.com/CVE-2023-1086/): Preview Link Generator < 1.0.4 - Arbitrary Plugin Activation via CSRF (medium 4.3)
- [CVE-2023-1084](https://insights.sbomify.com/CVE-2023-1084/): Privilege escalation in GitLab (low 2.7)
- [CVE-2023-1083](https://insights.sbomify.com/CVE-2023-1083/): Welotec: improper access control in TK500v1 router series (critical 9.8)
- [CVE-2023-1082](https://insights.sbomify.com/CVE-2023-1082/): Welotec: Command injection vulnerability in TK500v1 router series (high 8.8)
- [CVE-2023-1081](https://insights.sbomify.com/CVE-2023-1081/): Cross-site Scripting (XSS) - Stored in microweber/microweber (medium 5.7)
- [CVE-2023-1080](https://insights.sbomify.com/CVE-2023-1080/): GN Publisher <= 1.5.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-1079](https://insights.sbomify.com/CVE-2023-1079/): Use after free in Linux kernel (medium 6.8)
- [CVE-2023-1078](https://insights.sbomify.com/CVE-2023-1078/): Memory corruption in Linux kernel (high 7.8)
- [CVE-2023-1077](https://insights.sbomify.com/CVE-2023-1077/): Memory corruption in Linux kernel (high 7.0)
- [CVE-2023-1076](https://insights.sbomify.com/CVE-2023-1076/): Security feature bypass in Linux kernel (medium 5.5)
- [CVE-2023-1075](https://insights.sbomify.com/CVE-2023-1075/): Information disclosure in Linus kernel (low 3.3)
- [CVE-2023-1074](https://insights.sbomify.com/CVE-2023-1074/): Denial of service in kernel (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/419/